Bookoff Group Holdings has put numbers on its member-data breach: 6,383,279 people were affected, drawn from 6,427,735 member records taken from the system. The company's second report gives the confirmed scope; see also Earlier Tokyo Brief coverage.
Two counts, two denominators
The larger figure counts member numbers whose data the system logs show were sent outside. The smaller counts people, with multiple member records registered under the same email address treated as one person. Of the 6,383,279, some 6,170,908 are current members and 212,371 have withdrawn.
Only app, online-store and Web members are covered. Customers who use a member card alone, without app or web registration, are outside the breach.
What was exposed
The company says information that may have leaked includes name, date of birth, gender, email address, phone number, registered postal code and address, password hash, point-card number and member number. Not every member had every item exposed. A password hash is a converted form of the password that cannot be read back directly.
Payment details such as credit card numbers and bank account information are not managed in the affected member system, the company says, so they are not part of the leak. Images of ID documents submitted for home-delivery purchases are kept in a separate system from the affected one. Text read from ID documents at store counters is also excluded. Those exclusions narrow the damage but do not make the exposed contact and identity details harmless.
Access window and containment
Bookoff Group Holdings says a consolidated subsidiary's domestic member-management system was accessed by a third party. The company confirmed the intrusion on October 6 and says member data was obtained from outside between October 4 and 6.
The company says it has cut off the attacker's communications and the route used, and that containment of the known extraction route is complete. It says no new extraction has been confirmed. It also says it has not confirmed that the data has been published, that points have been misused, or that real members' records have been altered. These are the company's own statements.
It is working with outside specialists on the cause and running an emergency review of all group systems. It is withholding technical details such as system configuration, vulnerabilities and attack methods, saying disclosure could invite further attacks. It has reported to the Personal Information Protection Commission and consulted the police.
What members are asked to do
Individual emails to registered addresses begin on Thursday, October 15, and will go out in sequence. The company expects the rollout to take some time given the number of members. Members whose registered address no longer works will be covered by the public notice instead.
Affected members are asked to change their passwords for the official online store and app, and to change any identical or similar passwords used on other services. The company says its emails will not carry a link to a password-change page and that it will never ask for passwords, card details or bank details by email, text or phone.
Financial impact
The incident happened after the end of the first quarter, so first-quarter results are unaffected. The company says it is still assessing the financial effect and has not included it in its consolidated forecast for the fiscal year ending May 2027.